goauthentik / goauthentik/authentik

outpost/ldap: search filter not working with multiple objectClass

Open
#7,835 7 comments 1 reaction 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Describe the bug**
When an LDAP search query is sent with multiple OR including objectClasses, the outpost LDAP filters on the latest objectClass attribute found within the query.

**To Reproduce**
Use a query such as the following
`(| (&(objectclass=user)(uid=adm*)) (&(objectclass=group)(cn=adm*)) (&(objectclass=user)(mail=adm*)) (&(objectclass=group)(uid=adm*)) (&(objectclass=user)(sn=adm*)) )`

**Expected behavior**
It must return all users or groups which matches one of the following predicates:
- User attrbitue `uid` starts with the value `adm`
- User attrbitue `mail` starts with the value `adm`
- User attrbitue `sn` starts with the value `adm`
- Group attrbitue `cn` starts with the value `adm`
- Group attrbitue `uid` starts with the value `adm`

**Screenshots**
If applicable, add screenshots to help explain your problem.

**Logs**
N/A

**Version and Deployment (please complete the following information):**

- authentik version: 2023.10.4
- Deployment: helm

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.